build: align authentication runtime on Node 24

docker/core.Dockerfile

@@ -1,14 +1,14 @@
 # syntax=docker/dockerfile:1.7
-# thothii-core: Fastify (Node 22) + harness Python 3.12 (tht CLI) + runtime Pi.
+# thothii-core: Fastify (Node 24.16) + harness Python 3.12 (tht CLI) + runtime Pi.
 # Singolo container, entrypoint logico "server" (default).
 ARG PI_VERSION=0.80.3
 ARG IMAGE_VERSION=local
 
 # ---- Pinned Node source for the runtime binary and npm ----
-FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS node-runtime
+FROM node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7 AS node-runtime
 
 # ---- Stage 0: locked Pi runtime ----
-FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS pi-runtime-build
+FROM node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7 AS pi-runtime-build
 ARG PI_VERSION
 ARG PI_RUNTIME_PACKAGE_VERSION
 ARG PI_PACKAGE_NAME=@earendil-works/pi-coding-agent
@@ -22,14 +22,14 @@ RUN if [ -n "$PI_RUNTIME_PACKAGE_VERSION" ]; then \
  && test "$(./node_modules/.bin/pi --version)" = "$PI_VERSION"
 
 # ---- Stage 1: backend TypeScript -> dist ----
-FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS backend-build
+FROM node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7 AS backend-build
 WORKDIR /src/backend
 COPY backend/package*.json ./
 RUN npm ci
 COPY backend/ ./
 RUN npm run build
 
-# ---- Stage 2: runtime (Python 3.12 nativo + Node 22 copiato, stesso glibc bookworm) ----
+# ---- Stage 2: runtime (Python 3.12 nativo + Node 24.16 copiato, stesso glibc bookworm) ----
 FROM python:3.12-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b AS runtime
 ARG PI_VERSION
 ARG IMAGE_VERSION
@@ -50,7 +50,7 @@ RUN set -eux; \
     command -v flock >/dev/null 2>&1; \
     ln -s /usr/bin/fdfind /usr/local/bin/fd
 
-# Node 22 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
+# Node 24.16 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
 COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
@@ -83,7 +83,7 @@ RUN mkdir -p /app/harness/config \
 # PiProcessManager (backend) prepende harnessDir/.venv/bin al PATH del child Pi → symlink al venv reale
 RUN ln -s /opt/venv /app/harness/.venv
 
-# Backend: dist + node_modules (stesso Node major 22 + glibc bookworm → compatibili)
+# Backend: dist + node_modules (stesso Node major 24 + glibc bookworm → compatibili)
 COPY --from=backend-build /src/backend/dist /app/backend/dist
 COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules
 COPY backend/package*.json /app/backend/

docker/frontend.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 # thothii-frontend: build Vite (React) + nginx-unprivileged (porta 8080).
 ARG IMAGE_VERSION=local
-FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS build
+FROM node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7 AS build
 WORKDIR /src
 COPY frontend/package*.json ./
 RUN npm ci

docker/smoke/core-smoke.sh

@@ -7,8 +7,8 @@ test -n "${PI_VERSION:-}"
 node_version="$(node --version)"
 python_version="$(python --version 2>&1)"
 case "$node_version" in
-  v22.19.*|v22.2[0-9].*|v2[3-9].*|v[3-9][0-9].*) ;;
-  *) echo "Node 22.19+ required, found $node_version" >&2; exit 1 ;;
+  v24.16.*) ;;
+  *) echo "Node 24.16 required, found $node_version" >&2; exit 1 ;;
 esac
 case "$python_version" in
   "Python 3.1"[1-9].*|"Python 3."[2-9][0-9].*) ;;